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In the Specification: 

Please replace the paragraph from page 9, line 23-page 10, line 4 with the 
following: 

A user initiates access to the database in the form of a user request 1 14, which passes 
through the network 106 for delivery to the DB access gateway 1 12 as an incoming request 1 16. 
A data security device 120 is connected via a switch 122 or other connectivity device such as a 
tap, router or bridge, on the path from the network 106 to the host 104. The data security device 
120 includes a DB monitor 124 for receiving user requests 1 14 sent through the switch 122. The 
DB monitor receives and analyzes the incoming user request 1 14 as a tapped access attempt 118, 
which the DB monitor 124 analyzes according to a predetermined security or access policy. 
Such an access policy is discussed in greater detail in copending U.S. patent application No. 
10 / 5 762.660 entitled "SYSTEM AND METHODS FOR ADAPTIVE BEHAVIOR 
BASED ACCESS CONTROL," filed January 22, 2004 (Atty. Docket No. GRD03-03), 
incorporated herein by reference. The data security device 120 then passes the tapped access 
attempt 1 1 8 to the access gateway (AG) 1 12 as an incoming request 1 16. 

Please replace the paragraph from page 11, lines 11-21 with the following: 

The IPC intercept 140 444- identifies the attempt 132 to access the database resource 
from the local client 130. Such access attempts are local to the host 104 and directed to an 
access gateway 1 12 of the database resource 1 10, as shown in step 201. The local client 130 
initiating the local access 132 typically represents a local DBA account or a local user TELNET 
access for example. In the exemplary configuration, the majority of the access attempts 1 16 
occur via the front end internet 106 access. The local agent, however, accesses 132 via the so- 
called "back end" to the DB host 104, which has the effect of avoiding the network data security 
device 120 by employing the IPC mechanism 134. Both local attempts 132 and remote attempts 
1 16, however, are directed to the DB access gateway 112. Therefore, the local attempts 132 are 
identifiable by observing IPC communications to the gateway 1 12. 



Please replace the paragraph from page 1 1 , line 22-page 12, line 3 with the following: 
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The IPC intercept 140 intercepts the identified attempt 132 to access the database 
resource 1 10, in which intercepting occurring in a prioritized manner with respect to receipt of 
the access attempt 132 by the access gateway 1 12, as depicted at step 202. Accordingly, the IPC 
intercept 140454 allows the local agent 150 to capture and divert such a local access attempt 142. 
In the exemplary configuration, the prioritized receipt of the local access attempt 132 allows the 
IPC intercept 140 to receive the access attempt 132 before receipt by the DB access gateway 
1 12. The local agent 150 then transmits the intercepted access attempt 152 in a nondestructive 
manner operable to preserve the intercepted access attempt for successive receipt by the access 
gateway 1 12, thereby not precluding the expected receipt of the access attempt by the access 
gateway 1 12, as depicted at step 203. Accordingly, by forwarding the access attempt 132 back to 
the data security device 120, the DB monitor 124 enforces the access policy uniformly for all 
accesses to the DB server 108. 

Please replace the paragraph from page 13, line 28-page 14, line 6 with the following 
Each of the local event objects 172-N has a corresponding notification list 174-1.. 174-3 
(174-N generally) in the notification lists 166 portion. Note that the shared memory IPC 
intercept mechanism 134' may, in alternate configurations, be replaced with another IPC 
intercept 140444. In such a configuration, the DB interface wrapper 140' is similarly set up to 
receive IPC communications in a prioritized manner, prior to receipt by the access gateway 1 12. 
The notification lists 174-N include entries 176 specifying a prioritized list of notifications to be 
made when the DB operation corresponding to the local event object 172 occurs in a local access 
attempt 132. In the typical IPC communication, the local client 130 writes the DB instruction 
170 to an intercept register 168-N, and notifies the event handler 180 of the write. 



